from Crypto.Util.number import *

n1 = 116117067844956812459549519789301338092862193317140117457423221066709482979351921356314593636327834899992321545232613626111009441254302384449742843180876494341637589103640217194070886174972452908589438599697165869525189266606983974250478298162924187424655566019487631330678770727392051485223152309309085945253
leak1 = 8605081049583982438298440507920076587069196185463800658188799677857096281403951362058424551032224336538547998962815392172493849395335237855201439663804417
leak2 = 13407373154151815187508645556332614349998109820361387104317659096666170318961881115942116046384020162789239054091769561534320831478500568385569270082820389
c = 77391898018025866504652357285886871686506090492775075964856060726697268476460193878086905273672532025686191143120456958000415501059102146339274402932542049355257662649758904431953601814453558068056853653214769669690930883469679763807974430229116956128100328073573783801082618261383412539474900566590518020658



a_list, b_list = [0], [0]
import itertools
cur_mod = 1
for i in range(512):
    cur_mod *= 2
    nxt_as, nxt_bs = [], []
    for al, bl in zip(a_list, b_list):
        for ah, bh in itertools.product([0, 1], repeat=2):
            aa, bb = ah * (cur_mod // 2) + al, bh * (cur_mod // 2) + bl
            if (aa * bb % cur_mod == n1 % cur_mod) and ((aa & bb) == leak1 % cur_mod) and ((aa | bb) == leak2 % cur_mod):
                nxt_as.append(aa)
                nxt_bs.append(bb)

    a_list, b_list = nxt_as, nxt_bs

for a, b in zip(a_list, b_list):
    if a * b == n1 and a * b - n1 == 0 and (a & b) - leak1 == 0 and ((aa | bb) == leak2 % cur_mod):
        break

p=a
q=b
e=65537
d=inverse(e,(p-1)*(q-1))
print(long_to_bytes(pow(c,d,n1)))
#b'paluctf{&&&|||&&&|||&&&&&&&&&&&&|||||||||}'